@heyo-sh/heyo-cms 0.0.0-stage → 0.2.0

package/dist/ai/assistant/run.d.ts

@@ -0,0 +1,59 @@
+/**
+ * The panel-wide AI assistant.
+ *
+ * One agent, running inside the CMS process, with a small set of typed tools
+ * that call the ordinary public API. That last part is the whole design: a
+ * mutating tool goes through `cms.api.*` / `cms.globals.*` / `cms.media.*`
+ * with the real actor and `source: "ai"`, so an agent write passes exactly the
+ * same access control, field access, validation, hooks, media accounting,
+ * events and activity log as somebody typing into the form.
+ *
+ * There is no SQL tool, no adapter access, no fetch, no file read and no
+ * credential tool. The question "what could a prompt injection make this do"
+ * has a bounded answer because the surface is bounded.
+ *
+ * Nothing re-exports this directory as a barrel on purpose: `ai/service.ts`
+ * imports `./assistant/run` lazily, so a project without the assistant never
+ * resolves the agent runtime's optional dependencies.
+ */
+import type { Actor } from "../../types/actor";
+import type { AiApprovePlanArgs, AiApprovePlanResult, AiAssistantArgs, AiAssistantEvent } from "../../types/ai";
+import type { AiAuth, ResolvedCmsConfig } from "../../types/config";
+import type { DatabaseAdapter } from "../../types/database";
+import type { CmsInstance } from "../../types/instance";
+import type { JsonObject } from "../../types/json";
+export interface AssistantRunOptions {
+    args: AiAssistantArgs;
+    config: ResolvedCmsConfig;
+    cms: CmsInstance;
+    database: () => Promise<DatabaseAdapter>;
+    authFor: (provider: string) => Promise<AiAuth>;
+    record: (type: "ai.agent.completed" | "ai.agent.failed" | "ai.agent.mutation.applied", data: JsonObject, actor: Actor | null, failure?: unknown) => Promise<void>;
+}
+/**
+ * One run of the assistant, as a stream of events the panel understands.
+ *
+ * An async generator rather than a callback or a `Response`: the HTTP layer
+ * wants a stream, a test wants an array, and `cms.ai.runAssistant()` as a local
+ * API wants to be awaited in a loop. All three are the same object here, and
+ * none of them can see pi's own event vocabulary.
+ */
+export declare function runAssistant(options: AssistantRunOptions): AsyncGenerator<AiAssistantEvent>;
+export interface ApprovePlanOptions {
+    args: AiApprovePlanArgs;
+    config: ResolvedCmsConfig;
+    cms: CmsInstance;
+    database: () => Promise<DatabaseAdapter>;
+    record: (type: "ai.agent.completed" | "ai.agent.failed" | "ai.agent.mutation.applied", data: JsonObject, actor: Actor | null, failure?: unknown) => Promise<void>;
+}
+/**
+ * Executing a plan a human approved.
+ *
+ * The model is not in this function and that is the whole point. The row is
+ * read, the session is checked again, the permissions are checked again by
+ * the engine on every write, and the operations run exactly as they were
+ * stored. An approval that went back through the model would be an approval
+ * of something the editor never saw.
+ */
+export declare function approvePlan(options: ApprovePlanOptions): Promise<AiApprovePlanResult>;
+//# sourceMappingURL=run.d.ts.map

package/dist/ai/assistant/run.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"run.d.ts","sourceRoot":"","sources":["../../../src/ai/assistant/run.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAIH,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,mBAAmB,CAAC;AAC/C,OAAO,KAAK,EACV,iBAAiB,EACjB,mBAAmB,EACnB,eAAe,EACf,gBAAgB,EAKjB,MAAM,gBAAgB,CAAC;AACxB,OAAO,KAAK,EACV,MAAM,EAEN,iBAAiB,EAClB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AAE5D,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AACxD,OAAO,KAAK,EAAE,UAAU,EAAa,MAAM,kBAAkB,CAAC;AAoB9D,MAAM,WAAW,mBAAmB;IAClC,IAAI,EAAE,eAAe,CAAC;IACtB,MAAM,EAAE,iBAAiB,CAAC;IAC1B,GAAG,EAAE,WAAW,CAAC;IACjB,QAAQ,EAAE,MAAM,OAAO,CAAC,eAAe,CAAC,CAAC;IACzC,OAAO,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IAC/C,MAAM,EAAE,CACN,IAAI,EACF,oBAAoB,GAAG,iBAAiB,GAAG,2BAA2B,EACxE,IAAI,EAAE,UAAU,EAChB,KAAK,EAAE,KAAK,GAAG,IAAI,EACnB,OAAO,CAAC,EAAE,OAAO,KACd,OAAO,CAAC,IAAI,CAAC,CAAC;CACpB;AAED;;;;;;;GAOG;AACH,wBAAuB,YAAY,CACjC,OAAO,EAAE,mBAAmB,GAC3B,cAAc,CAAC,gBAAgB,CAAC,CA2OlC;AAED,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,iBAAiB,CAAC;IACxB,MAAM,EAAE,iBAAiB,CAAC;IAC1B,GAAG,EAAE,WAAW,CAAC;IACjB,QAAQ,EAAE,MAAM,OAAO,CAAC,eAAe,CAAC,CAAC;IACzC,MAAM,EAAE,CACN,IAAI,EACF,oBAAoB,GAAG,iBAAiB,GAAG,2BAA2B,EACxE,IAAI,EAAE,UAAU,EAChB,KAAK,EAAE,KAAK,GAAG,IAAI,EACnB,OAAO,CAAC,EAAE,OAAO,KACd,OAAO,CAAC,IAAI,CAAC,CAAC;CACpB;AAED;;;;;;;;GAQG;AACH,wBAAsB,WAAW,CAC/B,OAAO,EAAE,kBAAkB,GAC1B,OAAO,CAAC,mBAAmB,CAAC,CAgD9B"}

package/dist/ai/assistant/runtime.d.ts

@@ -0,0 +1,35 @@
+import type { AiUsage } from "../../types/ai";
+/**
+ * `@mariozechner/pi-agent-core`, under the floor.
+ *
+ * The same arrangement as `pi-ai` in `../pi.ts` and for the same two reasons:
+ * a deployment without AI must not carry an agent runtime in its bundle, and
+ * the package is an optional peer dependency — a CMS that refused to start
+ * because the agent library is missing would make the assistant mandatory in
+ * all but name.
+ *
+ * The one difference is that there is no fallback. `ai.complete` is a real
+ * seam for a field action, because a field action is one prompt and one
+ * answer. An agent is a tool-call loop, and a single completion cannot
+ * emulate one; pretending otherwise would produce an assistant that confidently
+ * describes writes it never made. So when the package is absent the endpoint
+ * says so, by name.
+ */
+type AgentModule = typeof import("@mariozechner/pi-agent-core");
+export type Agent = InstanceType<AgentModule["Agent"]>;
+export type AgentTool = import("@mariozechner/pi-agent-core").AgentTool;
+export type AgentEvent = Parameters<Parameters<Agent["subscribe"]>[0]>[0];
+export declare function agentRuntime(): Promise<AgentModule>;
+/** What a tool hands back to the model. Text only, by construction. */
+export declare function toolText(text: string): {
+    content: {
+        type: "text";
+        text: string;
+    }[];
+    details: Record<string, never>;
+};
+/** The empty usage a run that never reached a model still has to report. */
+export declare function emptyUsage(): AiUsage;
+export declare function addUsage(left: AiUsage, right: AiUsage): AiUsage;
+export {};
+//# sourceMappingURL=runtime.d.ts.map

package/dist/ai/assistant/runtime.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"runtime.d.ts","sourceRoot":"","sources":["../../../src/ai/assistant/runtime.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,gBAAgB,CAAC;AAE9C;;;;;;;;;;;;;;;GAeG;AAEH,KAAK,WAAW,GAAG,cAAc,6BAA6B,CAAC,CAAC;AAEhE,MAAM,MAAM,KAAK,GAAG,YAAY,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,CAAC;AACvD,MAAM,MAAM,SAAS,GAAG,OAAO,6BAA6B,EAAE,SAAS,CAAC;AACxE,MAAM,MAAM,UAAU,GAAG,UAAU,CAAC,UAAU,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAI1E,wBAAsB,YAAY,IAAI,OAAO,CAAC,WAAW,CAAC,CAQzD;AAED,uEAAuE;AACvE,wBAAgB,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG;IACtC,OAAO,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;IAC1C,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;CAChC,CAEA;AAED,4EAA4E;AAC5E,wBAAgB,UAAU,IAAI,OAAO,CAEpC;AAED,wBAAgB,QAAQ,CAAC,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,GAAG,OAAO,CAO/D"}

package/dist/ai/assistant/schema.d.ts

@@ -0,0 +1,66 @@
+import type { Actor } from "../../types/actor";
+import type { ResolvedCmsConfig, ResolvedCollection } from "../../types/config";
+/**
+ * The project, as the model may know it.
+ *
+ * This is the whole answer to "how does the agent know the format of the
+ * database". Not a dump of the configuration — the configuration is full of
+ * closures, secrets and hook bodies — but a serialisable projection of it,
+ * rebuilt per actor, containing only what that actor can already see by
+ * opening the panel.
+ *
+ * Fetched on demand through `describe_cms` rather than pasted into the system
+ * prompt. A project with sixty collections would otherwise cost its entire
+ * schema in tokens on every turn of every conversation, including the ones
+ * that only asked what time it is.
+ */
+export interface AssistantFieldDescription {
+    name: string;
+    type: string;
+    label: string;
+    required: boolean;
+    localized: boolean;
+    /** Present for `select`/`multiselect`: the values that are legal. */
+    options?: string[];
+    /** Present for `relation`: the collection an id has to come from. */
+    relationTo?: string;
+    /** `false` means the actor may read it but not write it. */
+    writable: boolean;
+}
+export interface AssistantCollectionDescription {
+    name: string;
+    slug: string;
+    label: string;
+    kind: "collection" | "global";
+    titleField: string | null;
+    fields: AssistantFieldDescription[];
+    can: {
+        read: boolean;
+        create: boolean;
+        update: boolean;
+        delete: boolean;
+    };
+}
+export interface AssistantSchema {
+    collections: AssistantCollectionDescription[];
+    globals: AssistantCollectionDescription[];
+    defaultLocale: string;
+    locales: string[];
+    media: boolean;
+    trash: boolean;
+    /**
+     * Changes when the shape does.
+     *
+     * The cache key for one run. A schema the agent looked at two tool calls ago
+     * is still the schema it is writing against, and re-deriving it per call
+     * would be the one part of this file that costs anything.
+     */
+    fingerprint: string;
+}
+export declare function describeCmsFor(config: ResolvedCmsConfig, actor: Actor | null, locales: string[]): AssistantSchema;
+/** Whether a field could be written at all by this actor, right now. */
+export declare function mayWriteField(collection: ResolvedCollection, name: string, actor: Actor | null, locale: string): boolean;
+/** Whether a field's value may be read by this actor. */
+export declare function mayReadField(collection: ResolvedCollection, name: string, actor: Actor | null, locale: string): boolean;
+export declare function titleField(collection: ResolvedCollection): string | null;
+//# sourceMappingURL=schema.d.ts.map

package/dist/ai/assistant/schema.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../../../src/ai/assistant/schema.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,mBAAmB,CAAC;AAC/C,OAAO,KAAK,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AAIhF;;;;;;;;;;;;;GAaG;AAEH,MAAM,WAAW,yBAAyB;IACxC,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,OAAO,CAAC;IAClB,SAAS,EAAE,OAAO,CAAC;IACnB,qEAAqE;IACrE,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IACnB,qEAAqE;IACrE,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,4DAA4D;IAC5D,QAAQ,EAAE,OAAO,CAAC;CACnB;AAED,MAAM,WAAW,8BAA8B;IAC7C,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,YAAY,GAAG,QAAQ,CAAC;IAC9B,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,MAAM,EAAE,yBAAyB,EAAE,CAAC;IACpC,GAAG,EAAE;QAAE,IAAI,EAAE,OAAO,CAAC;QAAC,MAAM,EAAE,OAAO,CAAC;QAAC,MAAM,EAAE,OAAO,CAAC;QAAC,MAAM,EAAE,OAAO,CAAA;KAAE,CAAC;CAC3E;AAED,MAAM,WAAW,eAAe;IAC9B,WAAW,EAAE,8BAA8B,EAAE,CAAC;IAC9C,OAAO,EAAE,8BAA8B,EAAE,CAAC;IAC1C,aAAa,EAAE,MAAM,CAAC;IACtB,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,KAAK,EAAE,OAAO,CAAC;IACf,KAAK,EAAE,OAAO,CAAC;IACf;;;;;;OAMG;IACH,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,wBAAgB,cAAc,CAC5B,MAAM,EAAE,iBAAiB,EACzB,KAAK,EAAE,KAAK,GAAG,IAAI,EACnB,OAAO,EAAE,MAAM,EAAE,GAChB,eAAe,CAkBjB;AA+ED,wEAAwE;AACxE,wBAAgB,aAAa,CAC3B,UAAU,EAAE,kBAAkB,EAC9B,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,KAAK,GAAG,IAAI,EACnB,MAAM,EAAE,MAAM,GACb,OAAO,CAUT;AAED,yDAAyD;AACzD,wBAAgB,YAAY,CAC1B,UAAU,EAAE,kBAAkB,EAC9B,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,KAAK,GAAG,IAAI,EACnB,MAAM,EAAE,MAAM,GACb,OAAO,CAGT;AA4BD,wBAAgB,UAAU,CAAC,UAAU,EAAE,kBAAkB,GAAG,MAAM,GAAG,IAAI,CAYxE"}

package/dist/ai/assistant/tools.d.ts

@@ -0,0 +1,41 @@
+import type { Actor } from "../../types/actor";
+import type { AiMutationTarget } from "../../types/ai";
+import type { CollectionApi, GlobalApi } from "../../types/api";
+import type { ResolvedCmsConfig, ResolvedCollection } from "../../types/config";
+import type { CmsInstance } from "../../types/instance";
+import type { JsonObject } from "../../types/json";
+import { type ResolvedPageContext } from "./context";
+import { planSummary, PlanStore } from "./plans";
+import { type AgentTool } from "./runtime";
+/**
+ * What a tool is allowed to change about the run around it.
+ *
+ * Narrow on purpose. A tool may read the configuration, call the instance,
+ * announce a mutation and park a plan. It cannot reach the transport, the
+ * conversation, the model or the system prompt — which is what makes "the
+ * record said to ignore previous instructions" a sentence in a tool result
+ * rather than a privilege escalation.
+ */
+export interface ToolContext {
+    config: ResolvedCmsConfig;
+    cms: CmsInstance;
+    actor: Actor | null;
+    page: ResolvedPageContext;
+    runId: string;
+    plans: PlanStore;
+    /** Announced to the panel the moment a write commits. */
+    onMutation: (target: AiMutationTarget, fields: string[]) => void;
+    /** Announced when a plan needs a human. */
+    onPlan: (plan: ReturnType<typeof planSummary>) => void;
+    /** Spent by every tool call; the server's budget, not the model's. */
+    spend: () => void;
+    signal?: AbortSignal | undefined;
+}
+export declare function createAssistantTools(context: ToolContext): AgentTool[];
+export declare function collectionApi(context: {
+    cms: CmsInstance;
+}, collection: ResolvedCollection): CollectionApi<JsonObject>;
+export declare function globalApi(context: {
+    cms: CmsInstance;
+}, global: ResolvedCollection): GlobalApi<JsonObject>;
+//# sourceMappingURL=tools.d.ts.map

package/dist/ai/assistant/tools.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tools.d.ts","sourceRoot":"","sources":["../../../src/ai/assistant/tools.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,mBAAmB,CAAC;AAC/C,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AACvD,OAAO,KAAK,EAAE,aAAa,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAChE,OAAO,KAAK,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AAChF,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AACxD,OAAO,KAAK,EAAE,UAAU,EAAa,MAAM,kBAAkB,CAAC;AAE9D,OAAO,EAAgC,KAAK,mBAAmB,EAAE,MAAM,WAAW,CAAC;AACnF,OAAO,EAEL,WAAW,EACX,SAAS,EAEV,MAAM,SAAS,CAAC;AAQjB,OAAO,EAAY,KAAK,SAAS,EAAE,MAAM,WAAW,CAAC;AAarD;;;;;;;;GAQG;AACH,MAAM,WAAW,WAAW;IAC1B,MAAM,EAAE,iBAAiB,CAAC;IAC1B,GAAG,EAAE,WAAW,CAAC;IACjB,KAAK,EAAE,KAAK,GAAG,IAAI,CAAC;IACpB,IAAI,EAAE,mBAAmB,CAAC;IAC1B,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,SAAS,CAAC;IACjB,yDAAyD;IACzD,UAAU,EAAE,CAAC,MAAM,EAAE,gBAAgB,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,IAAI,CAAC;IACjE,2CAA2C;IAC3C,MAAM,EAAE,CAAC,IAAI,EAAE,UAAU,CAAC,OAAO,WAAW,CAAC,KAAK,IAAI,CAAC;IACvD,sEAAsE;IACtE,KAAK,EAAE,MAAM,IAAI,CAAC;IAClB,MAAM,CAAC,EAAE,WAAW,GAAG,SAAS,CAAC;CAClC;AAED,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,WAAW,GAAG,SAAS,EAAE,CAoBtE;AA8iCD,wBAAgB,aAAa,CAC3B,OAAO,EAAE;IAAE,GAAG,EAAE,WAAW,CAAA;CAAE,EAC7B,UAAU,EAAE,kBAAkB,GAC7B,aAAa,CAAC,UAAU,CAAC,CAQ3B;AAED,wBAAgB,SAAS,CACvB,OAAO,EAAE;IAAE,GAAG,EAAE,WAAW,CAAA;CAAE,EAC7B,MAAM,EAAE,kBAAkB,GACzB,SAAS,CAAC,UAAU,CAAC,CAMvB"}

package/dist/ai/assistant/values.d.ts

@@ -0,0 +1,33 @@
+import type { ResolvedCollection } from "../../types/config";
+import type { JsonObject, JsonValue } from "../../types/json";
+/**
+ * The record, rendered for a model.
+ *
+ * Rich text becomes Markdown, because a ProseMirror document costs three times
+ * the tokens to say the same thing and no model writes one back correctly.
+ * Everything is length-capped, with the truncation stated in the text rather
+ * than hidden: a model that cannot tell it was given half a document will
+ * confidently rewrite the half it saw and delete the rest.
+ */
+export declare function renderRecord(collection: ResolvedCollection, document: JsonObject, visible: string[]): string;
+/**
+ * One field of a patch, in the shape the field stores.
+ *
+ * Exactly one conversion happens here — Markdown to a ProseMirror document for
+ * `richText` — and nothing else is "helpfully" coerced. A model that answered
+ * `"42"` for a number field has misunderstood the schema, and silently
+ * parsing it would hide the misunderstanding until the day it answers
+ * `"forty-two"`. The validation error is the useful outcome: the agent reads
+ * it, re-reads the schema and corrects itself.
+ */
+export declare function shapeFieldValue(collection: ResolvedCollection, name: string, value: JsonValue): JsonValue;
+/**
+ * The title a human would recognise the record by.
+ *
+ * Falls back to the id, which is always true and occasionally useful. A search
+ * result labelled `undefined` is worse than one labelled `doc_8sKq…`.
+ */
+export declare function recordTitle(document: JsonObject, titleField: string | null): string;
+/** A one-line gist of a record, for a search result that must stay short. */
+export declare function recordSummary(collection: ResolvedCollection, document: JsonObject, skip: string[], limit?: number): string;
+//# sourceMappingURL=values.d.ts.map

package/dist/ai/assistant/values.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"values.d.ts","sourceRoot":"","sources":["../../../src/ai/assistant/values.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AAE7D,OAAO,KAAK,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAO9D;;;;;;;;GAQG;AACH,wBAAgB,YAAY,CAC1B,UAAU,EAAE,kBAAkB,EAC9B,QAAQ,EAAE,UAAU,EACpB,OAAO,EAAE,MAAM,EAAE,GAChB,MAAM,CAuBR;AA6BD;;;;;;;;;GASG;AACH,wBAAgB,eAAe,CAC7B,UAAU,EAAE,kBAAkB,EAC9B,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,SAAS,GACf,SAAS,CAYX;AAED;;;;;GAKG;AACH,wBAAgB,WAAW,CACzB,QAAQ,EAAE,UAAU,EACpB,UAAU,EAAE,MAAM,GAAG,IAAI,GACxB,MAAM,CAKR;AAED,6EAA6E;AAC7E,wBAAgB,aAAa,CAC3B,UAAU,EAAE,kBAAkB,EAC9B,QAAQ,EAAE,UAAU,EACpB,IAAI,EAAE,MAAM,EAAE,EACd,KAAK,SAAM,GACV,MAAM,CAaR"}

package/dist/ai/crypto.d.ts

@@ -0,0 +1,12 @@
+export declare function encryptSecret(plaintext: string, secret: string): Promise<string>;
+/**
+ * Decrypts, or says what is wrong.
+ *
+ * A value that will not decrypt is almost always a rotated secret rather
+ * than tampering, and the error says so: the alternative is an operator
+ * staring at "AI failed" after changing an environment variable.
+ */
+export declare function decryptSecret(stored: string, secret: string): Promise<string>;
+/** The last four characters, so a key can be recognised but not used. */
+export declare function keyHint(token: string): string;
+//# sourceMappingURL=crypto.d.ts.map

package/dist/ai/crypto.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"crypto.d.ts","sourceRoot":"","sources":["../../src/ai/crypto.ts"],"names":[],"mappings":"AAsCA,wBAAsB,aAAa,CACjC,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,MAAM,CAAC,CAWjB;AAED;;;;;;GAMG;AACH,wBAAsB,aAAa,CACjC,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,MAAM,CAAC,CAmBjB;AAED,yEAAyE;AACzE,wBAAgB,OAAO,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAE7C"}

package/dist/ai/index.d.ts

@@ -0,0 +1,19 @@
+/**
+ * The AI runtime (section 8).
+ *
+ * Two things live here and they are deliberately separate. A **field action**
+ * is one prompt about one field that produces a value a human approves —
+ * `field.ai` is its only switch. The **assistant** is a panel-wide agent with
+ * tools that read and write through the ordinary API; `ai.assistant` is its
+ * only switch. Importing this module registers the built-in field actions, so
+ * `generate`, `improve`, `summarize`, `translate`, `alt` and `tags` exist for
+ * any field type that declares them — and `defineAiAction()` adds one on
+ * exactly the same terms.
+ */
+export { aiActionsFor, altAction, customAiAction, defineAiAction, generateAction, getAiAction, improveAction, registeredAiActions, summarizeAction, tagsAction, translateAction, } from "./registry";
+export { decryptSecret, encryptSecret, keyHint } from "./crypto";
+export { assertModelExists, authTypesForAiProvider, modelsForProvider, piCompletion, } from "./pi";
+export { aiCredentialsTable, createAi } from "./service";
+export { describeCmsFor } from "./assistant/schema";
+export type { AssistantSchema } from "./assistant/schema";
+//# sourceMappingURL=index.d.ts.map

package/dist/ai/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/ai/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AACH,OAAO,EACL,YAAY,EACZ,SAAS,EACT,cAAc,EACd,cAAc,EACd,cAAc,EACd,WAAW,EACX,aAAa,EACb,mBAAmB,EACnB,eAAe,EACf,UAAU,EACV,eAAe,GAChB,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,OAAO,EAAE,MAAM,UAAU,CAAC;AACjE,OAAO,EACL,iBAAiB,EACjB,sBAAsB,EACtB,iBAAiB,EACjB,YAAY,GACb,MAAM,MAAM,CAAC;AACd,OAAO,EAAE,kBAAkB,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AAIzD,OAAO,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AACpD,YAAY,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC"}

package/dist/ai/pi.d.ts

@@ -0,0 +1,89 @@
+import type { AiCompletionFn, AiUsage } from "../types/ai";
+import type { AiAuth } from "../types/config";
+import type { AiModelRef } from "../types/fields";
+type PiApi = import("@mariozechner/pi-ai").Api;
+type PiModel<T extends PiApi> = import("@mariozechner/pi-ai").Model<T>;
+/**
+ * The two ways pi lets a caller authenticate, as the agent takes them.
+ *
+ * Typed structurally rather than against `AgentOptions` on purpose: this file
+ * must stay importable when `@mariozechner/pi-agent-core` is not installed,
+ * which is the normal case for a deployment that only uses field actions.
+ */
+export interface PiAgentAuthOptions {
+    getApiKey?: (provider?: string) => string | Promise<string>;
+    streamFn?: (...args: Parameters<typeof import("@mariozechner/pi-ai").streamSimple>) => ReturnType<typeof import("@mariozechner/pi-ai").streamSimple>;
+}
+/**
+ * pi, under the floor.
+ *
+ * The same arrangement as `heyo-docs` (section 8): pi owns the provider
+ * catalogue and the transport, and it never appears in the configuration. A
+ * user writes `{ provider: "openai", model: "gpt-4o-mini" }` and the only
+ * thing this file does is look that pair up, attach the right kind of
+ * credential, and hand back text and a token count.
+ *
+ * Imported dynamically for two reasons that both matter in this project: a
+ * deployment without an `ai` section must not carry a provider catalogue in
+ * its bundle, and `@mariozechner/pi-ai` is an optional peer dependency — a
+ * CMS that refuses to start because AI is not installed would make AI
+ * mandatory in all but name.
+ */
+type PiModule = typeof import("@mariozechner/pi-ai");
+export declare function pi(): Promise<PiModule>;
+/**
+ * The model object pi works with, from the `{ provider, model }` pair the
+ * configuration carries.
+ *
+ * Shared with the agent rather than reimplemented beside it: a one-shot
+ * completion and an agent run must not disagree about which model
+ * `{ provider: "openai", model: "gpt-4o-mini" }` names, and the failure mode
+ * if they did would be a run that silently costs ten times as much.
+ */
+export declare function piModelFor(reference: AiModelRef): Promise<PiModel<PiApi>>;
+/**
+ * Refuses credentials a provider cannot use, before a request is built.
+ *
+ * The alternative is a 401 from somebody else's API with a message about a
+ * header the operator never wrote.
+ */
+export declare function assertAuthMatches(provider: string, auth: AiAuth): void;
+/**
+ * How the agent authenticates, in pi's own vocabulary.
+ *
+ * API keys and OAuth are a function that produces a bearer token; Bedrock is
+ * not, because AWS signs the request rather than carrying a token, so it has
+ * to replace the stream function instead. Keeping all three here — rather
+ * than in the agent — is what makes `ai.auth` mean the same thing for a field
+ * action and for the assistant.
+ */
+export declare function piAgentAuthOptions(provider: string, auth: AiAuth): Promise<PiAgentAuthOptions>;
+export declare function authTypesForAiProvider(provider: string): readonly AiAuth["type"][];
+/**
+ * Checks a provider and model against the catalogue pi actually ships.
+ *
+ * Done before a request leaves, so a typo in a model name is an error that
+ * names the provider rather than a 404 from somebody's API an hour later.
+ */
+export declare function assertModelExists(provider: string, model: string): Promise<void>;
+/** Models pi knows for a provider; empty when the provider is unknown. */
+export declare function modelsForProvider(provider: string): Promise<string[]>;
+/**
+ * The default completion: one prompt in, one answer out.
+ *
+ * Non-streaming on purpose. A field action produces a value that a person
+ * approves before it is stored, so the only thing streaming would buy is a
+ * progress animation — at the price of a second transport contract through
+ * the handler, the adapters and the panel.
+ */
+export declare const piCompletion: AiCompletionFn;
+export declare function toUsage(usage: {
+    input: number;
+    output: number;
+    totalTokens: number;
+    cost: {
+        total: number;
+    };
+}): AiUsage;
+export {};
+//# sourceMappingURL=pi.d.ts.map

package/dist/ai/pi.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pi.d.ts","sourceRoot":"","sources":["../../src/ai/pi.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EACV,cAAc,EAGd,OAAO,EACR,MAAM,aAAa,CAAC;AACrB,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAC;AAC9C,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAElD,KAAK,KAAK,GAAG,OAAO,qBAAqB,EAAE,GAAG,CAAC;AAC/C,KAAK,OAAO,CAAC,CAAC,SAAS,KAAK,IAAI,OAAO,qBAAqB,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC;AAEvE;;;;;;GAMG;AACH,MAAM,WAAW,kBAAkB;IACjC,SAAS,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,MAAM,KAAK,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAC5D,QAAQ,CAAC,EAAE,CACT,GAAG,IAAI,EAAE,UAAU,CAAC,cAAc,qBAAqB,EAAE,YAAY,CAAC,KACnE,UAAU,CAAC,cAAc,qBAAqB,EAAE,YAAY,CAAC,CAAC;CACpE;AAED;;;;;;;;;;;;;;GAcG;AAEH,KAAK,QAAQ,GAAG,cAAc,qBAAqB,CAAC,CAAC;AAIrD,wBAAsB,EAAE,IAAI,OAAO,CAAC,QAAQ,CAAC,CAQ5C;AAED;;;;;;;;GAQG;AACH,wBAAsB,UAAU,CAC9B,SAAS,EAAE,UAAU,GACpB,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAiBzB;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,IAAI,CAOtE;AAED;;;;;;;;GAQG;AACH,wBAAsB,kBAAkB,CACtC,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,MAAM,GACX,OAAO,CAAC,kBAAkB,CAAC,CA2B7B;AAKD,wBAAgB,sBAAsB,CACpC,QAAQ,EAAE,MAAM,GACf,SAAS,MAAM,CAAC,MAAM,CAAC,EAAE,CAI3B;AAED;;;;;GAKG;AACH,wBAAsB,iBAAiB,CACrC,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC,IAAI,CAAC,CAgBf;AAED,0EAA0E;AAC1E,wBAAsB,iBAAiB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAS3E;AAED;;;;;;;GAOG;AACH,eAAO,MAAM,YAAY,EAAE,cAiE1B,CAAC;AAEF,wBAAgB,OAAO,CAAC,KAAK,EAAE;IAC7B,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;IACf,WAAW,EAAE,MAAM,CAAC;IACpB,IAAI,EAAE;QAAE,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;CACzB,GAAG,OAAO,CAOV"}

package/dist/ai/registry.d.ts

@@ -0,0 +1,66 @@
+import type { AiActionContext, AiActionDefinition } from "../types/ai";
+export declare function defineAiAction(definition: AiActionDefinition): AiActionDefinition;
+export declare function getAiAction(id: string): AiActionDefinition | undefined;
+/** Action ids a field of this type may expose, in a stable menu order. */
+export declare function aiActionsFor(fieldType: string): string[];
+export declare function registeredAiActions(): string[];
+/**
+ * An action that exists only on one field.
+ *
+ * `field.ai` accepts a key nobody registered as long as it brings its own
+ * prompt — that is what makes `ai: { "tone-of-voice": { prompt: "…" } }`
+ * work without a `defineAiAction()` call. The behaviour is `generate`'s,
+ * because "write this field, here is the instruction" is the only thing a
+ * prompt alone can mean.
+ */
+export declare function customAiAction(id: string, prompt: string): AiActionDefinition;
+/**
+ * Write the field from scratch.
+ *
+ * The context fields are the whole of what the model sees. That is the point
+ * of `context` being per action: a title generated from the body should not
+ * also be shown the internal notes, and the only way to be sure is to name
+ * what travels.
+ */
+export declare const generateAction: AiActionDefinition;
+export declare const improveAction: AiActionDefinition;
+export declare const summarizeAction: AiActionDefinition;
+/**
+ * Translate from another locale.
+ *
+ * Only on a localized field, and that is checked rather than assumed: a
+ * translation written into a field that stores one value for every language
+ * would overwrite the original, which is the kind of data loss an editor
+ * discovers a week later.
+ */
+export declare const translateAction: AiActionDefinition;
+/**
+ * Alternative text for an image.
+ *
+ * The bytes are sent when the deployment can load them and the model can
+ * read them; when it cannot, the action still answers from the filename and
+ * the document, because a wrong-but-editable suggestion beats a button that
+ * only works on some providers. The result is a suggestion either way: it
+ * lands in the form, and a person approves it.
+ */
+export declare const altAction: AiActionDefinition;
+/**
+ * Pick values from a fixed set.
+ *
+ * Constrained to the declared options and filtered against them afterwards:
+ * a model that invents a tag would otherwise fail validation on save, which
+ * is a confusing place to learn that the suggestion was never valid.
+ */
+export declare const tagsAction: AiActionDefinition;
+/**
+ * The system prompt.
+ *
+ * Built from the field rather than from a global instruction, because the
+ * model's job is "fill this field" and the most useful thing it can be told
+ * is what the field is.
+ */
+export declare function systemPrompt(context: AiActionContext): string;
+/** The named context fields, rendered for a prompt. Nothing else travels. */
+export declare function contextBlock(context: AiActionContext): string;
+export declare function renderValue(value: unknown): string;
+//# sourceMappingURL=registry.d.ts.map

package/dist/ai/registry.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"registry.d.ts","sourceRoot":"","sources":["../../src/ai/registry.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EACV,eAAe,EACf,kBAAkB,EAEnB,MAAM,aAAa,CAAC;AAerB,wBAAgB,cAAc,CAC5B,UAAU,EAAE,kBAAkB,GAC7B,kBAAkB,CAgBpB;AAED,wBAAgB,WAAW,CAAC,EAAE,EAAE,MAAM,GAAG,kBAAkB,GAAG,SAAS,CAEtE;AAED,0EAA0E;AAC1E,wBAAgB,YAAY,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,EAAE,CAQxD;AAED,wBAAgB,mBAAmB,IAAI,MAAM,EAAE,CAE9C;AAED;;;;;;;;GAQG;AACH,wBAAgB,cAAc,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,kBAAkB,CAQ7E;AAQD;;;;;;;GAOG;AACH,eAAO,MAAM,cAAc,EAAE,kBAQ3B,CAAC;AAEH,eAAO,MAAM,aAAa,EAAE,kBAkB1B,CAAC;AAEH,eAAO,MAAM,eAAe,EAAE,kBAQ5B,CAAC;AAEH;;;;;;;GAOG;AACH,eAAO,MAAM,eAAe,EAAE,kBAuB5B,CAAC;AAEH;;;;;;;;GAQG;AACH,eAAO,MAAM,SAAS,EAAE,kBAqCtB,CAAC;AAEH;;;;;;GAMG;AACH,eAAO,MAAM,UAAU,EAAE,kBAwCvB,CAAC;AA4CH;;;;;;GAMG;AACH,wBAAgB,YAAY,CAAC,OAAO,EAAE,eAAe,GAAG,MAAM,CAe7D;AAED,6EAA6E;AAC7E,wBAAgB,YAAY,CAAC,OAAO,EAAE,eAAe,GAAG,MAAM,CAQ7D;AAED,wBAAgB,WAAW,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAalD"}

package/dist/ai/service.d.ts

@@ -0,0 +1,31 @@
+import type { CmsAi } from "../types/ai";
+import type { ResolvedCmsConfig } from "../types/config";
+import type { DatabaseAdapter } from "../types/database";
+import type { CmsInstance } from "../types/instance";
+import type { Tx } from "../types/query";
+import type { BufferedEvent, OutboxEntryMeta } from "../engine/outbox";
+export declare const aiCredentialsTable = "cms_ai_credentials";
+export interface AiServiceOptions {
+    config: ResolvedCmsConfig;
+    database(): Promise<DatabaseAdapter>;
+    /** The bound instance, for reading documents and files under access control. */
+    cms(): CmsInstance;
+    emit(tx: Tx, events: BufferedEvent[], meta: OutboxEntryMeta): Promise<void>;
+    deliver(): void;
+}
+/**
+ * `cms.ai`.
+ *
+ * Present whether or not the configuration has an `ai` section, exactly like
+ * `cms.media` is present without `uploads`: the alternative is an optional
+ * property every caller has to narrow, and a 500 that says "cannot read
+ * property run of undefined" instead of a sentence naming the missing
+ * section.
+ *
+ * Everything the runtime does is one of two things — run one action on one
+ * field, or hold one conversation about one document — and both of them end
+ * by handing a value back to a human. Nothing in this file writes a document
+ * (section 8).
+ */
+export declare function createAi(options: AiServiceOptions): CmsAi;
+//# sourceMappingURL=service.d.ts.map

package/dist/ai/service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../../src/ai/service.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAYV,KAAK,EACN,MAAM,aAAa,CAAC;AACrB,OAAO,KAAK,EAEV,iBAAiB,EAElB,MAAM,iBAAiB,CAAC;AACzB,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AAGzD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAErD,OAAO,KAAK,EAAE,EAAE,EAAE,MAAM,gBAAgB,CAAC;AACzC,OAAO,KAAK,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AAMvE,eAAO,MAAM,kBAAkB,uBAAuB,CAAC;AAEvD,MAAM,WAAW,gBAAgB;IAC/B,MAAM,EAAE,iBAAiB,CAAC;IAC1B,QAAQ,IAAI,OAAO,CAAC,eAAe,CAAC,CAAC;IACrC,gFAAgF;IAChF,GAAG,IAAI,WAAW,CAAC;IACnB,IAAI,CAAC,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,aAAa,EAAE,EAAE,IAAI,EAAE,eAAe,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5E,OAAO,IAAI,IAAI,CAAC;CACjB;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,QAAQ,CAAC,OAAO,EAAE,gBAAgB,GAAG,KAAK,CA6dzD"}

package/dist/ai/variant-translation.d.ts

@@ -0,0 +1,6 @@
+import type { AiActionContext, AiActionOutcome } from "../types/ai";
+/** Translate prose in place, leaving the rich-text tree (including media IDs,
+ * links, marks and plugin nodes) intact. Markdown round-tripping the entire
+ * document would silently turn an image with a mediaId into a plain URL. */
+export declare function translateVariantRichText(context: AiActionContext): Promise<AiActionOutcome>;
+//# sourceMappingURL=variant-translation.d.ts.map

package/dist/ai/variant-translation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"variant-translation.d.ts","sourceRoot":"","sources":["../../src/ai/variant-translation.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,eAAe,EAAE,eAAe,EAAW,MAAM,aAAa,CAAC;AAG7E;;4EAE4E;AAC5E,wBAAsB,wBAAwB,CAC5C,OAAO,EAAE,eAAe,GACvB,OAAO,CAAC,eAAe,CAAC,CA8D1B"}

package/dist/ai.d.ts

@@ -0,0 +1,12 @@
+/**
+ * `@heyo-sh/heyo-cms/ai`.
+ *
+ * `defineAiAction()` and the pieces an action needs. The configuration never
+ * mentions pi; this entry point is where a deployment reaches past it — to
+ * register an action, to check a model against the catalogue, or to replace
+ * the completion function altogether.
+ */
+export { aiActionsFor, altAction, assertModelExists, authTypesForAiProvider, customAiAction, defineAiAction, describeCmsFor, generateAction, getAiAction, improveAction, modelsForProvider, piCompletion, registeredAiActions, summarizeAction, tagsAction, translateAction, } from "./ai/index";
+export type { AssistantSchema } from "./ai/index";
+export type { AiActionContext, AiActionDefinition, AiActionOutcome, AiApprovePlanArgs, AiApprovePlanResult, AiAssistantArgs, AiAssistantEvent, AiAssistantTurn, AiCompletionFn, AiCompletionRequest, AiCompletionResult, AiImageInput, AiMutationTarget, AiPageContext, AiPageContextKind, AiPlanOperationSummary, AiPlanSummary, AiProviderStatus, AiRunArgs, AiRunResult, AiUsage, CmsAi, } from "./types/ai";
+//# sourceMappingURL=ai.d.ts.map

package/dist/ai.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ai.d.ts","sourceRoot":"","sources":["../src/ai.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,EACL,YAAY,EACZ,SAAS,EACT,iBAAiB,EACjB,sBAAsB,EACtB,cAAc,EACd,cAAc,EACd,cAAc,EACd,cAAc,EACd,WAAW,EACX,aAAa,EACb,iBAAiB,EACjB,YAAY,EACZ,mBAAmB,EACnB,eAAe,EACf,UAAU,EACV,eAAe,GAChB,MAAM,YAAY,CAAC;AACpB,YAAY,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAClD,YAAY,EACV,eAAe,EACf,kBAAkB,EAClB,eAAe,EACf,iBAAiB,EACjB,mBAAmB,EACnB,eAAe,EACf,gBAAgB,EAChB,eAAe,EACf,cAAc,EACd,mBAAmB,EACnB,kBAAkB,EAClB,YAAY,EACZ,gBAAgB,EAChB,aAAa,EACb,iBAAiB,EACjB,sBAAsB,EACtB,aAAa,EACb,gBAAgB,EAChB,SAAS,EACT,WAAW,EACX,OAAO,EACP,KAAK,GACN,MAAM,YAAY,CAAC"}

package/dist/ai.js

@@ -0,0 +1 @@
+import"./index-g041kfa5.js";import{pe,Y,Le,me,Ct,Ao,ko,Ro,ro,io,so}from"./index-8x2em6c8.js";import"./index-sgdnp83t.js";import"./index-6m1kjq9g.js";import{Rn,Sn,Qn,Ke,xt}from"./index-6w10rch0.js";export{Le as aiActionsFor,io as altAction,Sn as assertModelExists,Rn as authTypesForAiProvider,Ct as customAiAction,pe as defineAiAction,xt as describeCmsFor,Ao as generateAction,Y as getAiAction,ko as improveAction,Qn as modelsForProvider,Ke as piCompletion,me as registeredAiActions,Ro as summarizeAction,so as tagsAction,ro as translateAction};

package/dist/auth/config.d.ts

@@ -0,0 +1,65 @@
+import type { ApiKeyConfig, AuthMethod, Duration, EditorAuthConfig, FirstUserConfig, OAuthCredentials, OidcConfig, PasswordPolicy, TokenDelivery } from "../types/config";
+export interface CmsUsersOptions {
+    methods: AuthMethod[];
+    sso?: OidcConfig;
+    twoFactor?: boolean;
+    apiKeys?: ApiKeyConfig;
+    session?: {
+        expiresIn?: Duration;
+    };
+    invites?: {
+        expiresIn?: Duration;
+    };
+    magicLink?: {
+        expiresIn?: Duration;
+    };
+    passwordReset?: {
+        expiresIn?: Duration;
+    };
+    providers?: Record<string, OAuthCredentials>;
+    password?: PasswordPolicy;
+    /**
+     * Whether the first account can be claimed from the sign-in screen.
+     *
+     * On by default, and only while there are no accounts at all: an empty
+     * `cms_users` is the only state in which the route answers, and the account
+     * that answers it is the one that closes it. `false` leaves
+     * `heyo-cms create-admin` as the only way in.
+     */
+    firstUser?: FirstUserConfig;
+    /**
+     * Delivers a magic link or a reset link to its owner.
+     *
+     * The CMS still sends no email: it hands the message to this function and
+     * the application decides what a mailbox is. Without it the magic-link and
+     * password-reset HTTP routes are not registered, because over HTTP the
+     * caller is an anonymous browser and a response carrying the token would
+     * let a stranger sign in as an administrator.
+     */
+    deliverToken?: (message: TokenDelivery) => void | Promise<void>;
+}
+/**
+ * Editor authentication.
+ *
+ * The CMS authenticates editors and nothing else: there is no identity for the
+ * users of the application being built, by design (section 0). API keys are
+ * configured here rather than as a separate feature, because a key is an
+ * authentication method that produces the same `Actor` a session does.
+ */
+export declare function cmsUsers(options: CmsUsersOptions): EditorAuthConfig;
+export interface OidcOptions {
+    issuer: string;
+    clientId?: string;
+    clientSecret?: string;
+    mapRoles?: (claims: Record<string, unknown>) => string[];
+    scope?: string;
+    provision?: boolean;
+}
+/**
+ * Single sign-on for organisations.
+ *
+ * `mapRoles` is the whole point: a company that already decides access in its
+ * identity provider should not have to decide it again in the CMS.
+ */
+export declare function oidc(options: OidcOptions): OidcConfig;
+//# sourceMappingURL=config.d.ts.map

package/dist/auth/config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../src/auth/config.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EACV,YAAY,EACZ,UAAU,EACV,QAAQ,EACR,gBAAgB,EAChB,eAAe,EACf,gBAAgB,EAChB,UAAU,EACV,cAAc,EACd,aAAa,EACd,MAAM,iBAAiB,CAAC;AAEzB,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,UAAU,EAAE,CAAC;IACtB,GAAG,CAAC,EAAE,UAAU,CAAC;IACjB,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,OAAO,CAAC,EAAE,YAAY,CAAC;IACvB,OAAO,CAAC,EAAE;QAAE,SAAS,CAAC,EAAE,QAAQ,CAAA;KAAE,CAAC;IACnC,OAAO,CAAC,EAAE;QAAE,SAAS,CAAC,EAAE,QAAQ,CAAA;KAAE,CAAC;IACnC,SAAS,CAAC,EAAE;QAAE,SAAS,CAAC,EAAE,QAAQ,CAAA;KAAE,CAAC;IACrC,aAAa,CAAC,EAAE;QAAE,SAAS,CAAC,EAAE,QAAQ,CAAA;KAAE,CAAC;IACzC,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;IAC7C,QAAQ,CAAC,EAAE,cAAc,CAAC;IAC1B;;;;;;;OAOG;IACH,SAAS,CAAC,EAAE,eAAe,CAAC;IAC5B;;;;;;;;OAQG;IACH,YAAY,CAAC,EAAE,CAAC,OAAO,EAAE,aAAa,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACjE;AAED;;;;;;;GAOG;AACH,wBAAgB,QAAQ,CAAC,OAAO,EAAE,eAAe,GAAG,gBAAgB,CA+DnE;AAED,MAAM,WAAW,WAAW;IAC1B,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,MAAM,EAAE,CAAC;IACzD,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,SAAS,CAAC,EAAE,OAAO,CAAC;CACrB;AAED;;;;;GAKG;AACH,wBAAgB,IAAI,CAAC,OAAO,EAAE,WAAW,GAAG,UAAU,CAQrD"}